This practice has, of course, been in use in the wider open source ecosystem for a long time.

It always struck me as incredibly strange that in a world where it is people's money/value/whatever-you-want-to-call-it that is at stake, such a simple precaution is repeatedly not being taken by crypto-currency projects everywhere.